java Spring security - 允许匿名访问
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/31507037/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Spring security - allowing anonymous access
提问by NRJ
I have implemented Oauth2 in my spring-boot app. In my security-context.xml, I have these lines -
我已经在我的 spring-boot 应用程序中实现了 Oauth2。在我的 security-context.xml 中，我有这些行 -
<sec:intercept-url pattern="/trusted/**" access="isAnonymous()" />
<sec:intercept-url pattern="/**" access="isFullyAuthenticated()" />
I want everything under /trusted to be available without authentication. However, I am still prompted for authentication when I try to access /trusted resources (theses are RESTful resources).
我希望 /trusted 下的所有内容无需身份验证即可使用。但是，当我尝试访问 /trusted 资源（这些是 RESTful 资源）时，仍会提示我进行身份验证。
Did I miss something else ?
我错过了什么吗？
[Edit:] I am running this app with a 'provided' tomcat instance.
[编辑：] 我正在使用“提供的”tomcat 实例运行此应用程序。
回答by Daniel Cottone
You just need to replace the trusted intercept expression accessattribute and it should work:
您只需要替换受信任的拦截表达式access属性，它应该可以工作：
<sec:intercept-url pattern="/trusted/**" filters="none" />
<sec:intercept-url pattern="/**" access="isFullyAuthenticated()" />
Though since Spring Security 3.1 has deprecated filters, you ought to use httptags to achieve the same effect:
尽管 Spring Security 3.1 已弃用filters，但您应该使用http标签来实现相同的效果：
<http pattern="/trusted/**" security="none"/>
<http auto-config='true'>
<intercept-url pattern="/**" access="isFullyAuthenticated()" />
<form-login login-page='/login.jsp'/>
</http>
回答by MS Ibrahim
<http>
<intercept-url pattern="/trusted/**" access="ROLE_USER,ROLE_GUEST" />
<intercept-url pattern="/messagePost.htm*" access="ROLE_USER" />
<intercept-url pattern="/messageDelete.htm*" access="ROLE_ADMIN" />
<anonymous username="guest" granted-authority="ROLE_GUEST" />
<remember-me />
</http>
<anonymous username="guest" granted-authority="ROLE_GUEST" />
<anonymous username="guest" granted-authority="ROLE_GUEST" />
You can define a role like ROLE_GUEST and mention like what the above code does. Any anonymous member can access the url pattern under ROLE_GUEST
你可以定义一个像 ROLE_GUEST 这样的角色，并像上面的代码那样提及。任何匿名成员都可以访问ROLE_GUEST下的 url 模式
回答by Paulius Matulionis
You configuration is wrong. Now image what's happening, you are telling Spring security to allow anonymous access to everything under /trusted/**which is OK, but then you tell it again to restrict all anonymous access under /**- which is every path in your application, which obviously restricts access to /trusted/**as well.
你配置错了。现在想象一下正在发生的事情，您告诉 Spring security 允许匿名访问所有可以访问的内容/trusted/**，但是然后您再次告诉它限制所有匿名访问/**- 这是应用程序中的每条路径，这显然也限制了访问/trusted/**。
You need to change your configuration into something like this:
您需要将配置更改为如下所示：
<sec:intercept-url pattern="/trusted/**" access="isAnonymous()" />
<sec:intercept-url pattern="/secure/**" access="isFullyAuthenticated()" />
and it will work.
它会起作用。
